Frontier large language models are routinely scored on how well they resist single malicious prompts. But real-world attackers do not stop after a single refusal. They adopt personas, reframe questions, spread risky content across several messages, and gradually escalate until the model produces a harmful response. New research from a security firm's AI threat intelligence unit shows that this multi-turn behavior is almost completely absent from industry safety benchmarks, and the gap between published scores and observed resilience is large enough to misrank leading models.

Single-turn vs. multi-turn: two different risk pictures

The research evaluated 15 closed flagship models from major AI vendors, testing roughly 30,000 single-turn prompts and nearly 7,000 multi-turn attacks across more than 1,400 conversations. The models came from OpenAI, Anthropic, Google, Amazon, and xAI. Across the group, multi-turn attack success rates climbed as high as 88%, an order of magnitude above the lowest result in the cohort. Single-turn and multi-turn testing produced different rankings, different failure maps, and different tail-risk profiles.

Every model in the cohort failed a meaningful share of multi-turn attacks. OpenAI's GPT-5.4 jumped about ninefold under iterative pressure, moving from a single-turn attack success rate in the low single digits to nearly 25%. Google's Gemini 3 Pro climbed from about 18% to 73%. xAI's Grok 4.1 Fast, in its non-reasoning configuration, topped the cohort at 88%. Anthropic's Claude family had the strongest single-turn refusal performance, with rates in the low single digits, yet still landed in the 11% to 16% range once attackers were allowed to adapt.

An 88% success rate means an attacker can almost always obtain a harmful output in a normal conversation. This is not a theoretical concern. Multi-turn attacks are a standard technique in adversarial AI, increasingly used in social engineering, disinformation campaigns, and automated abuse. The fact that leading models fail so often under this simple, human-like approach suggests that the safety community has been measuring the wrong thing.

Cross-regime gaps run in both directions

The differences were not uniform. Gemini 3 Pro rose by more than 55 points under iterative testing. Meanwhile, all three Amazon Nova variants moved the opposite way. Nova 2 Lite recorded a relatively high single-turn attack success rate and the lowest multi-turn rate in the entire cohort, at about 8%. More than half of the models tested showed an absolute gap of at least 15 points between the two regimes.

This cross-regime divergence is a red flag for anyone who relies on public benchmark scores to compare models. A model that looks strong in single-turn evaluations may be among the weakest under realistic attack conditions, and vice versa. The rankings themselves are unstable across evaluation regimes, which means procurement decisions based on single-turn scores alone are likely to be wrong in practice.

A researcher leading the study said the question buyers and regulators should ask before trusting a model is direct: "How secure is this model against real-world attack scenarios?" That translates to how well a model holds up against multi-turn, adaptive attacks. Real adversaries will not stop at the first refusal; they build additional context, reframe, or escalate across the conversation. Single-turn benchmark scores demonstrate how a model performs in scenarios attackers do not use.

A single configuration flag changes the picture

The same Grok 4.1 Fast model with reasoning mode enabled saw its multi-turn attack success rate cut roughly in half, a swing of more than 40 points tied to a single capability flag. The research notes that this kind of configuration-driven safety variation does not appear on any public benchmark or model card the authors reviewed. Users running the model in its default non-reasoning configuration encounter a substantially different threat profile from users who turn reasoning on.

This finding has direct implications for model deployment. Many organizations use the default settings of commercial APIs without realizing that safety properties can change dramatically based on inference parameters. A model that is safe with reasoning enabled may be unsafe without it. The research suggests that safety evaluations should be performed across configurations, not just on the default setup, and that model cards should disclose configuration-specific attack success rates.

The work extends an earlier study of eight open-weight models, where multi-turn attack success rates ran two to ten times higher than single-turn baselines and reached more than 90% against one large open-weight model. Multi-turn vulnerability appears to be a structural property of the current frontier, present in both open and proprietary weights. It is not an artifact of a single vendor or a single model architecture.

Where the failures cluster

Five strategy families drove most of the multi-turn outcomes: role-play and persona adoption, contextual ambiguity, refusal reframing, information decomposition, and crescendo-style escalation. Within each family, the spread between the most and least exposed model was large, often approaching the full range of the chart. That pattern means strategy labels mostly sort which models pull apart from one another, even where average difficulty looks similar.

Role-play and persona adoption, for example, asks the model to act as a character that does not have the same safety constraints. Contextual ambiguity uses vague or contradictory instructions to confuse the model's guardrails. Refusal reframing takes a previous refusal and asks a slightly different question that bypasses the safety response. Information decomposition breaks a harmful request into smaller, seemingly harmless pieces. Crescendo escalation starts with benign prompts and gradually increases the intensity. These are not exotic techniques; they are common in everyday human conversation and should be covered by any robust safety evaluation.

On the single-turn side, three procedures dominated the rankings: Imposter AI, Soft Paraphrase, and System Prompts. By content type, hate speech, profanity, and specialized advice led. Imposter AI alone outpaced the tenth-ranked procedure by a wide margin, suggesting that targeted fixes to a handful of attack surfaces could move the aggregate numbers for most models in the cohort.

Guardrails reduce risk without eliminating it

Production deployments typically wrap base models in additional safety layers. The researchers said those layers help, but with limits. Guardrails attenuate risk but do not eliminate it. The base model sets the floor on what any production system can achieve. Just as traditional software development decisions involve risk tolerance and acceptance for the code itself and all its dependencies, the same approach applies to AI development and deployment. The blast radius for a rogue or misaligned AI agent, however, has the potential to be more damaging than a software flaw.

As AI agents gain autonomy and access to sensitive workflows, the risks multiply. An attacker who compromises an agent could use multi-turn attacks to exfiltrate data, manipulate decision-making, or trigger harmful actions. The research warns that agentic AI systems are a particularly dangerous application because they combine high-capability models with direct access to tools and systems. The multi-turn vulnerability of the underlying model becomes an even more serious issue when the model can act on the output.

What the research recommends

The team proposes three operational steps for organizations buying or deploying AI. First, publish attack success rates by strategy family on every model release. This would give buyers visibility into the types of attacks a model is vulnerable to, rather than a single aggregate score. Second, gate deployments on regressions in the top three procedures and content types using a 3-point threshold. That means if a new version becomes significantly worse on a key attack surface, it should not be deployed without explicit approval. Third, flag any model with a cross-regime gap above 15 points for manual review. Applied to the tested cohort, the third rule alone would surface more than half the models for closer examination.

Organizations that build their own safety evaluations should include multi-turn conversations from the start. A simple single-turn prompt set is no longer sufficient, especially for models that will be deployed in interactive or agentic settings. The research suggests that every model release should be accompanied by a detailed breakdown of attack success rates by strategy family, content type, and configuration. This level of transparency would allow security teams to make informed decisions.

Regulatory frameworks point in the same direction. The NIST AI Risk Management Framework, the forthcoming NIST Cyber AI Profile (IR 8596), and Article 15 of the EU AI Act all call for adversarial robustness testing. None currently specify the interaction regime, strategy decomposition, or slice-support labeling that the research argues is needed for decision-grade assessment. Standards bodies will need to catch up to the reality that multi-turn attacks are a distinct and measurable risk.

For developers and security teams, the immediate takeaway is that published safety numbers only tell part of the story. Multi-turn attack resilience is a separate dimension of security, one that can vary dramatically based on configuration, model family, and attack strategy. As AI agents become more common and more powerful, the cost of ignoring this gap will only increase. The research provides a concrete starting point for better evaluation, but the responsibility to act lies with model developers, procurement teams, and regulators alike.

Source:Help Net Security News